Medical Device Vigilance: Important Considerations to Comply With the EU MDR

Vigilance reporting and postmarket surveillance of medical devices are among the many requirements documented in the EU MDR (2017/745) to ensure the safety and effectiveness of devices. To comply, manufacturers are required to investigate all incidents and take corrective action, which can include changes to the design or manufacturing process of the device or providing additional instructions or training to users, when necessary.

Although notification of the new MDR regulations on medical devices in the EU market occurred in 2017 and the regulations became applicable in May 2021, many stakeholders in this sector, including manufacturers and service providers, have struggled to implement the new directives within the original timeline. Even experienced medical device vigilance professionals find understanding and implementing the new regulations complex, as demonstrated by the proportion of the attendees in our recent webinar on this topic with at least five years of experience who sought additional information from our experts.

Given the impact of non-compliance on the availability of medical devices, which could negatively affect businesses and patients alike, the implementation deadline was recently extended. Therefore, companies have the opportunity to use this time to align their processes with the MDR regulation. The good news is that real-world implementation of the new directives over the past couple of years has helped clarify some of the uncertainty surrounding the requirements, and this experience is helping to identify the best approach to interpreting the guidelines for future clinical investigation and postmarketing surveillance activities. Given the length of the guidelines, to help highlight some of the more critical aspects of vigilance, in this blog post, we’ll discuss case processing and reporting requirements specifically.

Medical Device Vigilance vs Pharmacovigilance

Medical device vigilance shares some of the same principles as pharmacovigilance, which is more established. These similarities include the following:

1. The need for a safety database with device case processing and reporting capabilities
2. A workflow pattern that involves intake, triage, data entry, quality review, and medical review
3. A reporting infrastructure that includes tracking, coordination with the clinical investigation site, safety management plan, documentation in terms of SAEs, and consent

The differences between pharmacovigilance and device vigilance lie in the nature of assessment and reporting requirements, which require niche expertise and include the following:

1. Causality assessment
2. Clinical reporting requirements
3. Post-marketing reporting requirements

We’ll go through each of these in detail in the following sections.

Causality Assessment

Causality assessment aims to minimize detrimental effects from adverse events by establishing whether there is a causal relationship between the use of a device and an adverse event. It also plays a crucial role in assessing the risk-benefit profiles of devices.

The underlying structural differences between drugs and devices drive the need for a different approach to causality assessments: After all, a drug is basically a small molecule that interacts with various receptors or molecules in the body to provide the desired result, whereas devices are physical objects designed to perform a specific function such as delivering the therapeutic agent or supporting a damaged organ or a tissue. As a result, the mechanisms by which drugs and devices can cause adverse events are often different.

To perform a causality assessment, a systematic review of available data such as clinical studies, postmarketing, surveillance reports, and individual case reports is conducted to identify any potential cost factors and assess their impact. The four cardinal principles to the causality assessment of adverse events include the following:

1. Temporal relationship between the device and the reaction
2. Biological plausibility of the device causing the reaction
3. Dechallenge, which is the response on withdrawal of the device
4. Rechallenge, which is the response on re-use of the device

The methods for causality assessment include the following:

1. Expert judgment or global introspection: process in which an expert expresses judgment about possible causation by considering available data relevant to a suspected adverse reaction
2. Algorithm based: systematic, standardized approach using a problem-specific flowchart with step-by-step instructions on how to arrive at an answer, including assessment of parameters, such as the time of onset of the adverse reaction or the temporal sequence, previous history of the adverse reaction, person’s medical history, and positive or negative rechallenge or dechallenge
3. Probability: consideration of the prior probability of the device based on prior epidemiologic studies and the specific case information, enabling simultaneous assessment of multiple causes

These principles and assessment methods result in the determination of the level of causality:

• Certain: the adverse event is associated with the investigational device beyond a reasonable doubt — to identify the combination of factors contributing to the event, all efforts should be made to correctly define the relationship, by considering factors such as the underlying disease(s), concomitant medication(s), ongoing therapies, device characteristics, and procedure characteristics.
• Probable: relationship with the use of the investigational device seems relevant and cannot be reasonably explained by any other cause.
• Possible: a relationship with the use of the investigational device cannot be ruled out completely.
• Unlikely: this is the case when we have limited information regarding the relationship between the device and the event.
• Not related: there is no temporal relationship, biological plausibility, nor positive or negative dechallenge or rechallenge.

Clinical Reporting Requirements

The next area that differs between pharmacovigilance and medical device vigilance is how clinical reporting must be completed. For medical devices, the sponsor must report the following to all the national competent authorities (NCAs) where the clinical investigation is authorized to start:

• All reportable events that indicate an imminent risk of death, serious injury, or serious illness and require prompt remedial action for other patients/participants, users, or other persons or a new finding to it (no later than 2 calendar days after becoming aware of the situation)
  • Includes events that are of significant and unexpected nature such that they become alarming as a potential public health hazard
  • Includes the possibility of multiple deaths occurring at short intervals
  • Concerns identified by either the NCA or the manufacturer
• Any other reportable events or a new finding/update to it (no later than 7 calendar days after becoming aware of the situation)

To ensure the ability to meet these short timelines, the safety management plan (SMP) should include the steps to be taken, from the time the serious adverse event (SAE) is known until the reporting to the authorities is complete. All stakeholders, including the sponsor, site, device case processing team, and regulatory team should be aware of the SMP and their responsibilities for reporting.

Postmarketing Reporting Requirements

The requirements for reporting incidents during the postmarketing phase also differ and are lengthy for medical devices, taking up multiple articles in the guidelines. However, here, we present the basic requirements of which everyone should be aware.

Manufacturers of devices (other than investigational devices) available in the EU market need to report to the relevant competent authorities in the event of death or an unanticipated serious deterioration in a person’s state of health — immediately after the manufacturer has established a suspected causal relationship between the device and the serious incident AND no later than 10 calendar days after the manufacturer became aware of the serious incident.

For serious incidents, the reporting must occur immediately after establishing the causal relationship between that incident and their device or that such causal relationship is reasonably possible AND no later than 15 calendar days after the date of becoming aware of the incident.

We often get asked the difference between an incident and a serious incident with a device under the MDR. An incident is any malfunction or deterioration in a characteristic or the performance of the device, for example, an ergonomic feature that is not working or inadequate information provided with the device. Incidents, in general, do not need to be reported to the authorities, although they must be documented in the safety database. A serious incident leads to potential serious public health outcomes, such as death or temporary or permanent serious deterioration in the health of the patient. These need to be reported according to the timelines described here.

Reporting Formats

In addition to changes in reporting requirements and timelines, there are also new templates. For clinical investigations, the Clinical Investigation Safety Summary Reporting (CISSR) form should be used, and for postmarketing purposes, the Manufacturer Incident Report (MIR) form should be completed and can be generated directly from the database safety database. However, all of this is also transitional until the EUDAMED system is fully operational, when the web form will be used to report SAEs or serious incidents for both medical devices and in vitro diagnostic medical devices to the NCAs. At that point, it will provide information about the full lifecycle of medical devices available in the EU market.

Where to Find Additional Information

To meet article 105 of the MDR and article 99 of the In Vitro Diagnostic Medical Devices Regulation (IVDR), the Medical Device Coordination Group (MDCG) drafted a range of documents to assist stakeholders in applying the EU MDR. Although these documents are not legally binding, they provide detailed guidelines on each MDR regulation and can serve as a good starting point to better understand the requirements. Because many of the MDR sections are not that detailed, they are open to interpretation, and the MDCG documents can help guide that interpretation and with implementing the MDR in a more harmonized manner.

In addition, you can always reach out to our medical device vigilance experts in the Veranex Data Management & Analytics team, and make sure to watch the on-demand webinar recording for more information about the topics covered here.